CVE-2018-8736

A privilege escalation vulnerability in Nagios XI 5.2.x through 5.4.x before 5.4.13 allows an attacker to leverage an RCE vulnerability escalating to root...

CVE-2018-8734

CVE-2018-8734 is a SQL injection vulnerability in the core config manager of Nagios XI up to 5.4.x (before 5.4.13). An attacker can append arbitrary SQL commands via the selInfoKey1 parameter. Public connected documents corroborate this CVE alongside other Nagios XI flaws (e.g., chained RCE in ad...

Nagios XI Chained Remote Code Execution

This module exploits a few different vulnerabilities in Nagios XI 5.2.6-5.4.12 to gain remote root access. The steps are: 1. Issue a POST request to /nagiosql/admin/settings.php which sets the database user to root. 2. SQLi on /nagiosql/admin/helpedit.php allows us to enumerate API keys. 3. The A...

xorg-x11-server denial of service vulnerability (CNVD-2018-03146)

The xorg-x11-server is an X Window System display server bundled with multiple vendor operating systems. A security vulnerability exists in the 'ProcXIChangeHierarchy' function in versions of xorg-x11-server prior to 1.19.5, which stems from incorrect extra length detection. An attacker can explo...

DEBIAN-CVE-2017-12178

xorg-x11-server before 1.19.5 had wrong extra length check in ProcXIChangeHierarchy function allowing malicious X client to cause X server to crash or possibly execute arbitrary code...

ALPINE-CVE-2016-7945

Multiple integer overflows in X.org libXi before 1.7.7 allow remote X servers to cause a denial of service out-of-bounds memory access or infinite loop via vectors involving length fields...

Nagios XI 5.2.9 Cross Site Scripting / Open Redirect

Credits: John Page aka hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/NAGIOS-XI-V5.2.9-MULTIPLE-VULNERABILITIES.txt + ISR: ApparitionSec Vendor: ============== www.nagios.com Product: ================ Nagios XI v5.2.9 Nagios XI provides network,...

Nagios XI 5.2.9 Cross Site Scripting / Open Redirect Vulnerabilities

Exploit for php platform in category web applications + Credits: John Page aka hyp3rlinx Vendor: ============== www.nagios.com Product: ================ Nagios XI v5.2.9 Nagios XI provides network, server, and application monitoring in one easy to configure package along with advanced alerting an...

PT-2016-7439 · X.Org +3 · Libxi +3

Name of the Vulnerable Software and Affected Versions: X.org libXi versions prior to 1.7.7 Description: The issue allows remote X servers to cause a denial of service, resulting in an infinite loop. This is achieved through vectors involving length fields. Recommendations: For versions prior to...

PT-2016-7438 · X.Org +3 · Libxi +3

Name of the Vulnerable Software and Affected Versions: X.org libXi versions prior to 1.7.7 Description: The issue involves multiple integer overflows that can be exploited by remote X servers, leading to a denial of service. This can result in out-of-bounds memory access or an infinite loop,...

Nagios XI < 5.2.8 Multiple Vulnerabilities

Binary data 9588.prm...

Nagios XI has multiple vulnerabilities

Nagios is a free and open source host and service monitoring software. Nagios XI has multiple security vulnerabilities. Contains SQL injection, authentication bypass, execution of arbitrary code via command injection, privilege escalation, server-side request forgery, and account hijacking. These...

Nagios XI <= 5.2.7 remote code execution

No description provided by source...

Nagios XI Chained - Remote Code Execution (Metasploit)

Exploit for linux platform in category remote exploits This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Nagios XI Chained Remote Code Execution', 'Description' = %q This module exploits an SQL...

Nagios XI Chained Remote Code Execution

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Nagios XI Chained Remote Code Execution', 'Description' = %q This module exploits an SQL injection, auth bypass, file upload, command injection, a...

Red Line Drawn: China Recalculates Its Use of Cyber Espionage

On Sept. 25, 2015, President Barack Obama and Chinese President Xi Jinping agreed that neither government would “conduct or knowingly support cyber-enabled theft of intellectual property” for an economic advantage. Some observers hailed the agreement as a game changer for U.S. and Chinese...

Red Line Drawn: China Recalculates Its Use of Cyber Espionage

On Sept. 25, 2015, President Barack Obama and Chinese President Xi Jinping agreed that neither government would “conduct or knowingly support cyber-enabled theft of intellectual property” for an economic advantage. Some observers hailed the agreement as a game changer for U.S. and Chinese...

Nagios XI Incident Manager Integration Component SQL Injection

A SQL injection vulnerability has been reported in the Nagios Incident Manager IM integration component of Nagios XI. The vulnerability is due to insufficient parameter validation when processing HTTP requests. A remote, unauthenticated attacker can exploit this vulnerability by sending a special...

Nagios XI Multiple Vulnerabilities (Jun 2016)

Nagios XI is prone to multiple vulnerabilities. This VT has been deprecated and replaced by the VT with the OID: 1.3.6.1.4.1.25623.1.0.105749. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right...

Nagios XI 5.2.7 - Multiple Vulnerabilities

Exploit for php platform in category web applications Nagios XI Multiple Vulnerabilities Affected versions: Nagios XI = 5.2.7 PDF: http://www.security-assessment.com/files/documents/advisory/NagiosXI-Advisory.pdf +-----------+ |Description| +-----------+ The Nagios XI application is affected by...